Security hole in RIP-2

[Gary Scott Malkin <[e-mail]>]

There is a potential security hole in the RIP-2 authentication caused
by the backwards compatibility rules.  If you're running sending RIP-2
packets and accepting either version, there is no problem with the
periodic responses because they never leave you network so nobody can
snoop them to find the password.  This means that nobody from outside
your network can inject bogus routing packets because a RIP-2 router
would discard the unauthenticated response.  However, somebody from
outside could send a RIP-1 query to one of the routers sending RIP-2
responses.  The router would not authenticate the RIP-1 packet and
would then deliver the password in the response.

There are two solutions.  Ideally, the router has to be smart enough to
answer a RIP-1 query with a RIP-1 response, which may not be easy for
some implementations.  Otherwise, the documentation must clearly state
that authentication is only secure when the routers are configured to
accept only RIP-2 packets, so that the RIP-1 query would be discarded.

----------------------------------------------------------------------
Gary Malkin            "Felis Catus, is your taxonomic nomenclature an
[phone]         `exothermic quadruped, carnivorous by nature'?"